# Onamae Desktop Cloud (GMO Internet, Japan) infrastructure compromised; malware installed on up to 26,739 customer servers

> Unauthorized third parties accessed GMO Internet's Onamae.com Desktop Cloud (a VPS service widely used for FX automated trading) and installed malicious programs in customer server environments, potentially affecting 26,739 servers across all plans. The provider confirmed the malicious programs on 2026-10-20 and began shutting servers down sequentially at 04:00 JST on 2026-10-21, with no restart date announced.

- **Published:** 2026-10-21T21:53:24Z
- **Last reviewed:** 2026-10-24T00:05:31.323Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4065
- **ID:** TL-2026-4065
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-10-21 GMO Internet (operator of the Onamae.com domain registrar and hosting brand) announced that its Desktop Cloud service (Desktop Cloud byGMO) had suffered unauthorized access by a third party. The provider discovered on 2026-10-20 that malicious programs had been installed on servers in customer environments. The number of servers potentially affected is 26,739, and all Desktop Cloud plans are included.

The official notice states that information stored on the servers may have been viewed. At the time of announcement GMO had not confirmed leakage of personal information or misuse of any viewed information. Payment card and settlement data are not retained by the company on these servers and payment information is reported as stored separately and unaffected.

Containment: GMO began shutting down affected servers sequentially at 04:00 on 2026-10-21 (all plans stopped). Forensic analysis is ongoing and the restart timeline will be announced after the investigation. Customers who store or use authentication credentials (IDs, passwords) inside their servers were asked to change them promptly, including identical passwords reused elsewhere, and to beware of phishing that exploits the incident. GMO states it will never ask for passwords or card information by email or phone.

The Desktop Cloud service is a remotely operated Windows-style VPS marketed for running automated FX trading tools such as MetaTrader 4, so servers may hold trading-platform credentials, broker account access and EA/automation tooling. Initial access vector, malware family, command-and-control infrastructure, indicators of compromise and threat actor attribution have NOT been disclosed by the provider or press as of 2026-10-21. Because the intrusion apparently occurred at the provider/infrastructure layer and propagated to many tenant servers, it is classified as a supply-chain (hosting provider) compromise. MITRE mappings in this record are inferred from the described behavior (provider-level access, program installation, stored-information access, credential-rotation guidance, anticipated phishing) and should be treated as low-granularity until technical details are published.

## MITRE ATT&CK

- T1199 Trusted Relationship
- T1566 Phishing
- T1005 Data from Local System
- T1552 Unsecured Credentials
- T1657 Financial Theft

## Sources

- [Japan's Onamae Desktop Cloud hacked, up to 27,000 servers affected](https://www.bleepingcomputer.com/news/security/japans-onamae-desktop-cloud-hacked-up-to-27-000-servers-affected/)
- [Onamae.com official notice: unauthorized access to Desktop Cloud (GMO Internet)](https://www.onamae.com/news/article/11584)
- [「お名前.com デスクトップクラウド」不正プログラム設置で全プラン停止 FX用VPS、2万6739サーバに影響か (ITmedia NEWS)](https://news.yahoo.co.jp/articles/e6ad7eb921cdd18338a281f080844f4ffc0f7b17)
- [FX自動売買専用VPS「お名前.com デスクトップクラウド」、不正アクセス受けサーバー停止 (INTERNET Watch)](https://news.yahoo.co.jp/articles/53a9412176f3526091d673d643c6a8328d7d7c8f)
- [お名前.comのFX自動売買VPSに不正アクセス 2万6739件のサーバーに影響の可能性 全プラン順次停止 (livedoor News)](https://news.livedoor.com/article/detail/32617105/)
- [GMO「お名前.com デスクトップクラウド」全プラン停止 約2万7000件に影響の可能性 (ASCII.jp)](https://ascii.jp/elem/000/004/444/4444344/)
- [お名前.com「デスクトップクラウド」に不正アクセス、最大2万6,739サーバーに影響の可能性 (Security Measures Lab)](https://rocket-boys.co.jp/security-measures-lab/onamae_desktop_cloud_26739_servers_unauthorized_access_provider_impacts/)
- [GMO「お名前.com デスクトップクラウド」全プラン停止 (Yahoo!ニュース / ASCII)](https://news.yahoo.co.jp/articles/c2d1876632a1cd7f35e223c0965705fa38107385)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4065